HR Compliance: A Guide for Small Businesses
What HR compliance is, which federal laws apply by employee count, common issues, and best practices for small businesses without an HR department.
HR Compliance
A practical guide for small businesses without an HR department
The first time I thought seriously about HR compliance, it was because I got scared. We had grown to about a dozen people, and a founder friend mentioned offhand that his company had just been through a wage-and-hour claim. Not because they were bad actors. Because they had classified someone as exempt from overtime who legally was not, and nobody had checked.
That conversation sent me down a rabbit hole. What I found is that most of what is written about HR compliance is written for companies that already have an HR department, a compliance officer, and a legal budget. It assumes a team exists to do this work. When you have 15 employees and you are the founder, the sales lead, and the person who handles HR, that assumption does not hold.
This guide is the version I wish I had found then. It covers what HR compliance actually means, which laws apply to a business your size, where small companies most often get into trouble, and how to build a system that keeps you compliant without hiring a team. I built compliance features into FirstHR for exactly this situation, but the principles here apply no matter what tools you use.
What Is HR Compliance?
HR compliance is the practice of aligning your workplace policies, procedures, and recordkeeping with the employment laws and regulations that apply to your business. It spans the full employment relationship: how you hire, how you pay, how you keep people safe, how you handle leave, and how you separate. Compliance is not a one-time setup. It is an ongoing obligation that changes as laws change and as your headcount grows.
The word "compliance" makes it sound like a single checkbox, but it is really a moving target made of many separate obligations. Some are federal and apply everywhere. Some are set by your state and can be stricter. Some are local, set at the city or county level, and are multiplying quickly in areas like pay transparency and scheduling. A small business in one state can face a very different compliance picture than an identical business two states over.
For a deeper look at how the specific laws stack up as you add employees, the guide to human resource laws by company size maps each statute to the headcount where it kicks in. That headcount view is the single most useful lens for a small business, because it tells you exactly what you are responsible for right now.
Why HR Compliance Matters More for Small Business
HR compliance matters for small businesses because there is no size exemption for the foundational laws, and there is no HR team to catch mistakes. A 500-person company that misclassifies a worker has an HR department and a lawyer to fix it. A 15-person company that makes the same mistake has a founder who did not know the rule existed until a penalty notice arrived.
The financial exposure is real and growing. Federal minimum wage has held at $7.25 per hour since 2009, but penalties for violations have climbed steadily with inflation. As of the 2025 adjustments, OSHA serious violations reach $16,550 per violation, and willful or repeat violations reach $165,514 per violation (OSHA). These are not enterprise-only numbers. OSHA safety rules apply from your first employee.
There is a quieter cost too. Compliance failures rarely announce themselves. A misclassification sits unnoticed until an employee files a claim. A missing I-9 is invisible until an inspector asks for it. A handbook promise you did not keep is harmless until it becomes evidence in a dispute. The businesses that get hurt are usually not reckless. They are busy, and busy is how gaps form.
The Four Types of HR Compliance
HR compliance breaks into four types: statutory, regulatory, contractual, and union or collective. Understanding the distinction matters because each type comes from a different source and carries different consequences when you get it wrong. Statutory and regulatory obligations are imposed on you by law. Contractual obligations are ones you take on voluntarily and then must honor.
For most small businesses, the first three types are what matter day to day. Statutory and regulatory compliance define the floor you cannot go below. Contractual compliance is the one people forget: the moment you write "we provide two weeks of PTO" in a handbook or promise a bonus structure in an offer letter, you have created an obligation you must meet. Inconsistency between what you promised and what you do is its own form of risk.
Which Federal Laws Apply at Your Employee Count
Which federal employment laws apply to you depends primarily on how many employees you have. Some laws apply from the first employee. Others phase in at 15, 20, 50, and 100 employees. This staircase is the most practical way for a small business owner to understand their obligations: find your headcount, and you know your baseline.
| Law | Applies at | What it covers |
|---|---|---|
| Fair Labor Standards Act (FLSA) | 1+ employee (most employers) | Minimum wage, overtime, child labor, recordkeeping |
| OSHA (Occupational Safety and Health Act) | 1+ employee | Workplace safety and health standards |
| Form I-9 / IRCA | 1+ employee | Employment eligibility verification for every hire |
| Equal Pay Act | 1+ employee | Equal pay for equal work regardless of sex |
| Title VII (Civil Rights Act) | 15+ employees | Discrimination by race, color, religion, sex, national origin |
| Americans with Disabilities Act (ADA) | 15+ employees | Disability discrimination and reasonable accommodation |
| Pregnant Workers Fairness Act (PWFA) | 15+ employees | Accommodation for pregnancy and related conditions |
| Age Discrimination in Employment Act (ADEA) | 20+ employees | Discrimination against workers 40 and older |
| COBRA | 20+ employees | Continued health coverage after separation |
| Family and Medical Leave Act (FMLA) | 50+ employees | Job-protected unpaid leave for family and medical reasons |
| WARN Act / EEO-1 reporting | 100+ employees | Mass layoff notice and workforce demographic reporting |
The FMLA threshold is worth understanding precisely because it trips people up. Under DOL Fact Sheet #28, a covered employer is a private-sector business that employs 50 or more employees in 20 or more workweeks in the current or previous year. But an individual employee is only eligible if they have worked for you for 12 months, have at least 1,250 hours of service in the prior year, and work at a location where you have 50 employees within 75 miles. Coverage and eligibility are two separate tests.
The Most Common HR Compliance Issues
The most common HR compliance issues for small businesses cluster around a handful of predictable failure points. These are not exotic edge cases. They are the everyday errors that busy owners make because the rules are counterintuitive and nobody is watching until it is too late.
What these issues share is that each one is invisible until it is expensive. None of them announces itself. That is why the businesses that stay compliant are not the ones with the most legal knowledge. They are the ones with systems that surface these issues on a schedule instead of waiting for an agency to find them. The common HR issues guide covers the broader operational problems that compound these compliance risks.
Wage and Hour: The Most Expensive Mistake
Wage and hour compliance is where small businesses lose the most money, because the rules are technical and the penalties include back pay plus damages. The core FLSA obligations are simple to state: pay at least minimum wage, pay overtime at time-and-a-half for hours over 40 in a workweek, and keep accurate records. The trouble is in the exceptions.
The most common error is misclassifying an employee as exempt from overtime. A common myth is that paying someone a salary makes them exempt. It does not. Exemption depends on both a salary threshold and the actual duties of the job. An employee with a manager title who spends most of their time doing the same work as the people they supervise may not qualify as exempt, regardless of salary. The distinction between exempt and non-exempt is where audits begin.
Off-the-clock work is the other frequent trap. Time spent booting up systems before a shift, answering messages after hours, or working through an unpaid break can all count as hours worked. For hourly employees, those minutes are compensable, and failing to pay them is a violation even when it was unintentional. Accurate time records are your protection here. The payroll compliance guide covers the calculation rules in detail.
Worker Misclassification: Employee or Contractor
Worker misclassification means treating someone as an independent contractor when the law considers them an employee. It is one of the most scrutinized compliance areas because it affects taxes, overtime, benefits, and unemployment insurance all at once. Getting it wrong is expensive on multiple fronts simultaneously.
The hard part is that there is no single test. The IRS looks at behavioral and financial control. The DOL applies an economic reality test. Many states, led by California's ABC test, apply their own stricter standards. A worker can be a legitimate contractor under one test and an employee under another. When agencies disagree, the stricter classification usually wins, and the employer absorbs the cost.
The consequences of getting it wrong include back payroll taxes, unpaid overtime, penalties, and liability for benefits the worker should have received. If you rely on contractors, the safest approach is to apply the strictest applicable test and document your reasoning. The guides on employee versus contractor and misclassification walk through the specific tests and how to apply them.
I-9 and Work Authorization
I-9 compliance requires verifying the identity and work authorization of every employee using Form I-9, completing it on time, and retaining it correctly. This applies to every hire, from your first employee onward. There is no small-business exemption, and it has become one of the most actively enforced areas of employment law.
The timing rules are strict. The employee completes Section 1 no later than their first day of work. The employer completes Section 2, verifying documents, by the end of the third business day after the start date. Using the current version of the form matters: a revised Form I-9 with a January 20, 2025 edition date is now in use, though the prior August 1, 2023 edition remains acceptable through its expiration. Using an outdated form is itself a violation.
The most reliable way to stay compliant is to make I-9 completion a fixed step in onboarding with a hard deadline, not a task someone remembers to do. The guides on I-9 documentation and work authorization cover the document rules, and the onboarding documents guide shows where I-9 fits in the full new hire paperwork sequence.
Recordkeeping and Retention
Compliance recordkeeping means keeping the documents the law requires, for the periods the law requires, in a form you can produce on demand. Missing records are dangerous because they often convert a defensible position into a provable violation. When an auditor asks for a record you cannot produce, the absence itself is the finding.
Different records carry different retention periods. Payroll records under the FLSA must be kept for at least three years, and records used to compute pay for two years. I-9s follow the three-years-or-one-year-after-termination rule. Tax records, benefit documents, and hiring records each have separate timelines. When multiple rules overlap on a single document, keep it for the longest applicable period.
| Record type | Minimum retention | Governing rule |
|---|---|---|
| Form I-9 | 3 years after hire or 1 year after termination, whichever is later | IRCA / USCIS |
| Payroll records | At least 3 years | FLSA |
| Records used to compute pay (time cards) | 2 years | FLSA |
| Hiring and job application records | 1 year (longer if a charge is filed) | Title VII / ADA / EEOC |
| Tax records (W-4, payroll tax) | At least 4 years | IRS |
| Benefit plan documents | 6 years | ERISA |
For small businesses, the practical failure is not knowing the rules. It is storage. Records scattered across email, paper folders, and personal drives cannot be produced quickly, and the person who knew where everything was may have left. Centralizing personnel records in one system solves both problems. The guides on how long to keep employee records and organizing the personnel file cover the specifics.
HR Compliance Best Practices
The best practices for HR compliance are consistent across company sizes, but the implementation looks different when you do not have an HR team. The goal for a small business is to build compliance into your existing workflows so it happens without a dedicated person driving it.
| Best practice | What it means | Why it matters |
|---|---|---|
| Document everything | Put policies, decisions, and acknowledgments in writing | Undocumented policies are unenforceable and indefensible in a dispute |
| Apply policies consistently | Treat similar situations the same way for every employee | Inconsistency is the root of most discrimination claims |
| Audit on a schedule | Review I-9s, classifications, and postings at least annually | Finding gaps yourself is far cheaper than an agency finding them |
| Keep postings current | Display required federal and state labor law posters | Missing or outdated posters are an easy, avoidable citation |
| Train your managers | Teach the people who enforce policies what the rules are | Managers create liability through decisions they do not know are risky |
| Centralize records | Store everything in one system with retention built in | You cannot prove compliance with records you cannot find |
Consistency deserves special emphasis because it is the practice small businesses most often violate without realizing it. Discrimination claims rarely come from overt bias. They come from treating two similar employees differently: disciplining one for lateness while letting another slide, granting one person's schedule request and denying another's. The disparate treatment guide explains how these patterns create liability even without intent. For the broader operational playbook, the HR best practices guide covers what to build first.
An HR Compliance Checklist for Small Businesses
A practical compliance checklist for a small business covers the recurring obligations that must happen for every hire and on an ongoing basis. Use this as a starting framework, then layer your state and local requirements on top.
This checklist maps directly onto the hiring process, which is why compliance and onboarding are so tightly linked. Building these steps into your new hire workflow means they happen every time, not just when someone remembers. The compliance onboarding guide shows how to embed each item into the first days of employment.
How to Manage Compliance Without an HR Department
Managing HR compliance without an HR department comes down to replacing a person's memory with a system's reliability. The reason compliance fails at small companies is almost never ignorance of the law. It is that the person responsible got busy and a deadline slipped. Systems do not get busy.
The highest-leverage move is to automate the repeatable, deadline-driven work. I-9 completion tied to a start date. New hire reporting triggered on hire. Policy acknowledgments captured with e-signature during onboarding. Records stored automatically with retention periods attached. Once these run on triggers instead of memory, the most common failure points close. This is exactly what FirstHR automates for businesses in the 5 to 50 employee range: the compliance steps of hiring happen as part of the onboarding flow, and every signed document lands in an audit-ready record.
Software does not replace judgment. For genuinely complex questions, a multi-state expansion, a difficult termination, a novel accommodation request, a periodic review with an employment attorney is worth the cost. But those situations are the exception. The day-to-day compliance work that trips up most small businesses is repeatable, and repeatable work is exactly what a system handles better than a person. The small business HR guide covers how to run the whole function lean.
DIY, Software, or PEO: Choosing Your Approach
Small businesses generally manage compliance one of three ways: do it yourself, use HR software, or outsource to a PEO. The right choice depends on your headcount, your complexity, and how much of the liability and cost you want to carry yourself.
For most businesses in the 5 to 50 employee range, software hits the balance point. Pure DIY works at the smallest sizes but gets risky as you grow and the number of moving parts increases. A PEO removes the most liability but is the most expensive option and means giving up control over your own HR. Software sits in between: it automates the repeatable compliance work and keeps audit-ready records without the cost or loss of control of full outsourcing. The HR audit guide helps you assess where your current gaps are before you decide.
Frequently Asked Questions
What is HR compliance?
HR compliance is the practice of aligning your workplace policies, procedures, and recordkeeping with the employment laws and regulations that apply to your business. It covers federal, state, and local rules on hiring, pay, safety, leave, discrimination, immigration verification, and data privacy. For a small business, HR compliance means meeting the legal obligations of being an employer even without a dedicated HR team.
What are the main types of HR compliance?
There are four main types. Statutory compliance covers obligations created by legislation, such as minimum wage and anti-discrimination law. Regulatory compliance covers rules issued by agencies like OSHA, the EEOC, and the DOL. Contractual compliance covers commitments your business makes voluntarily in offer letters, handbooks, and employment agreements. Union or collective compliance covers obligations under collective bargaining agreements, which most small businesses never encounter.
Do employment laws apply to small businesses?
Yes. Many core employment laws apply from the very first employee, with no size exemption. The Fair Labor Standards Act, which governs minimum wage and overtime, applies to almost all employers. OSHA workplace safety rules apply from one employee. I-9 employment verification and state new hire reporting apply to every hire. Some laws phase in as you grow: Title VII and the ADA at 15 employees, the ADEA and COBRA at 20, and the FMLA at 50. Being small does not exempt you from the foundational obligations.
What are the most common HR compliance issues for small businesses?
The most common issues are wage and hour violations, such as misclassifying employees as exempt from overtime; worker misclassification, meaning treating a W-2 employee as a 1099 contractor; I-9 and work authorization errors; inconsistent hiring, discipline, or termination decisions that create discrimination risk; recordkeeping and retention failures; and, increasingly, data privacy and the use of automated tools in hiring. Wage and hour problems are the most frequent and often the most expensive.
How long do I have to keep employee records?
Retention periods vary by record type. Form I-9 must be kept for three years after the date of hire or one year after employment ends, whichever is later. Payroll records under the FLSA must be kept for at least three years. Records used to calculate pay, such as time cards, must be kept for two years. Tax records, benefit plan documents, and hiring records each have their own retention rules. When periods overlap, keep the record for the longest applicable period.
What happens if a small business fails an HR compliance audit?
Consequences depend on the agency and the violation. I-9 paperwork violations run from roughly $288 to $2,861 per form, and because fines are assessed per form, exposure adds up fast across a workforce. OSHA serious violations reach $16,550 per violation, with willful or repeat violations up to $165,514. Wage and hour violations can mean back pay, liquidated damages, and civil penalties. Beyond fines, there are legal fees, management time, and reputational cost. Documented good-faith compliance efforts often reduce penalties.
What are HR compliance best practices?
The core best practices are documenting everything in writing, applying policies consistently to every employee, conducting a regular internal audit, keeping required posters and notices current, training managers on the rules they enforce, and centralizing records so you can produce them on demand. For small businesses, the single highest-leverage practice is moving compliance from memory and scattered files into a system that tracks deadlines and stores records automatically.
How can a small business manage HR compliance without an HR department?
Most small businesses manage compliance through a combination of a clear checklist, automated software, and occasional professional advice. Software handles the repeatable work: completing I-9s on time, tracking new hire reporting deadlines, storing signed policy acknowledgments, and keeping audit-ready records. For complex or state-specific questions, a periodic review with an employment attorney or advisor fills the gaps. The goal is a system that does not depend on the owner remembering every deadline.